Weekly Security Intelligence Briefing, Week of 2026-02-09

“`html

Executive Summary

The week of February 9, 2026 presents an elevated threat posture driven by a convergence of nation-state activity, critical infrastructure targeting, and aggressively exploited vulnerabilities across widely deployed enterprise products. The most urgent threats requiring immediate action are CVE-2026-22719 (VMware Aria Operations RCE, CISA KEV deadline March 24), dual CVSS 10.0 vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079 and CVE-2026-20131), and a confirmed zero-day in the Android March 2026 patch rollup (CVE-2026-0006, CVSS 9.8). An AI-native threat platform designated CyberStrikeAI has compromised over 600 FortiGate devices, representing a meaningful escalation in automated offensive capability. Nation-state actors, including Russian APT28, Iranian multi-actor clusters, North Korean UNC4899, and a Chinese campaign targeting Asian critical infrastructure, remained highly active across financial, healthcare, government, and telecommunications sectors. The March 2026 Microsoft and Adobe Patch Tuesday addressed 79-84 vulnerabilities including two actively exploited zero-days. Supply chain risk intensified with malicious npm packages, Chrome extension ownership hijacks, and AI-assisted malvertising campaigns targeting developers. Security teams should prioritize the five CISA KEV items with deadlines in the next 30 days and validate FortiGate, Cisco, VMware, and Android/mobile device patch status immediately.

Critical Action Items

1. Patch VMware Aria Operations RCE, CISA KEV Deadline March 24, 2026
   CVE-2026-22719 (CVSS 8.1) allows unauthenticated remote code execution via command injection in VMware Aria Operations. CISA added this to the KEV catalog on March 3, 2026, with a federal remediation deadline of March 24, 2026. Apply the vendor patch immediately. If patching cannot be completed before the deadline, isolate Aria Operations instances from internet-accessible network segments pending remediation. Verify patch application on all nodes. Source: CISA KEV Catalog, SCC-CVE-2026-0001.
2. Patch Cisco Secure Firewall Management Center, Dual CVSS 10.0, No Workaround
   CVE-2026-20079 and CVE-2026-20131 both carry CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and affect the Cisco Secure Firewall Management Center. No workaround exists; patching is the only remediation path. Apply the March 2026 bundle advisory patch immediately. Treat any unpatched FMC instance as critically exposed. If patch application will be delayed, restrict FMC management-plane access to trusted management networks at the network layer. Source: Cisco Secure Firewall March 2026 Bundle Advisory, SCC-CVE-2026-0004.
3. Patch Hikvision Cameras and Rockwell Logix OT/ICS Systems, CISA KEV Deadline March 26, 2026
   CVE-2017-7921 (Hikvision cameras) and CVE-2021-22681 (Rockwell Automation Logix controllers) are confirmed actively exploited with CVSS 9.8. CISA added both to the KEV catalog on March 5, 2026, with a federal deadline of March 26, 2026. These are OT/ICS-adjacent vulnerabilities with direct critical infrastructure implications. Apply available patches; for Hikvision devices where firmware updates are not possible (legacy/EOL units), network-segment the devices and disable internet exposure. For Rockwell Logix, apply vendor mitigations per the ICS-CERT advisory. Source: CISA KEV Catalog, NVD, SCC-CVE-2026-0005.
4. Apply Android March 2026 Patches, Actively Exploited Zero-Day CVE-2026-0006 (CVSS 9.8)
   CVE-2026-0006 is an actively exploited Android zero-day with a CVSS score of 9.8. The March 2026 Android patch rollup addresses this and the accompanying Qualcomm kernel privilege escalation (CVE-2026-21385, CVSS 7.8). Push Android security updates to all managed mobile devices immediately. For unmanaged personal devices used in BYOD programs, issue an advisory requiring users to apply March 2026 patches before reconnecting to corporate resources. Confirm patch levels via your MDM/EMM platform. Source: Google Android Security Bulletin March 2026, SCC-CVE-2026-0003.
5. Patch Ivanti Endpoint Manager, CISA KEV, Active Exploitation Confirmed
   CISA flagged a high-severity Ivanti EPM vulnerability as actively exploited and ordered U.S. federal agencies to patch within three weeks. Organizations using Ivanti EPM should apply the available patch immediately. Review EPM logs for indicators of exploitation including anomalous agent behavior, unexpected privilege escalation, or unusual outbound connections from EPM server processes. Additionally, review CISA’s advisory for SolarWinds and VMware Workspace ONE vulnerabilities flagged the same week. Source: CISA KEV Catalog (March 10, 2026), BleepingComputer.
6. Audit FortiGate Devices for CyberStrikeAI Compromise Indicators
   The CyberStrikeAI AI-native attack platform has confirmed compromise of 600+ FortiGate devices. Security teams should immediately audit FortiGate device integrity, review configuration change logs for unauthorized modifications, check for unknown administrative accounts or VPN tunnel configurations, and verify firmware integrity. Cross-reference with Fortinet’s PSIRT advisories for associated CVEs being exploited in this campaign. Restrict management plane access and enforce MFA on all FortiGate management interfaces. Source: SCC-CAM-2026-0001, Fortinet PSIRT.

Key Security Stories

1. CyberStrikeAI Platform Automates Compromise of 600+ FortiGate Devices

A threat platform designated CyberStrikeAI represents a significant tactical evolution in offensive operations: an AI-native attack system capable of automating reconnaissance, exploitation, and post-exploitation at scale. The platform has confirmed compromise of more than 600 FortiGate devices as of early March 2026. This is not a single actor conducting targeted intrusions, it is an automated system reducing the skill threshold required to execute enterprise-grade network compromises.

The implications extend beyond FortiGate. The use of AI to orchestrate attack pipelines signals a trend where adversaries can maintain high operational tempo against a broad target set simultaneously. Detection signatures and behavioral baselines built against human-paced attacker activity may not catch the speed or volume of AI-automated campaigns. Security teams should validate FortiGate patch levels against all current Fortinet PSIRT advisories, enforce management-plane network segmentation, and review SIEM alerting for high-frequency, low-variation connection attempts that may indicate automated scanning.

Exploitation Status: Active, confirmed at scale.
Affected Products: FortiGate firewalls (specific firmware versions pending Fortinet PSIRT confirmation).
Remediation: Apply all current Fortinet PSIRT patches; restrict management access; enable integrity verification.
Source: SCC-CAM-2026-0001 (TechJacks SCC Pipeline, March 5, 2026).

2. March 2026 Patch Tuesday: 79-84 Vulnerabilities Including Two Actively Exploited Zero-Days

Microsoft’s March 2026 Patch Tuesday addressed between 79 and 84 vulnerabilities depending on source count, including two zero-days confirmed as actively exploited in the wild prior to patch release. Adobe issued coordinated updates in the same cycle. This is a high-volume patch release requiring prioritized triage. The two actively exploited zero-days should be treated as emergency patches regardless of your organization’s standard patch cadence.

Cisco Talos released Snort rules for prominent vulnerabilities in this cycle, providing immediate detection coverage for organizations that cannot patch immediately. The March 2026 Patch Tuesday also addresses vulnerabilities in Windows components that align with known attack patterns from current threat actor campaigns documented elsewhere in this briefing. The convergence of patch content with active campaign TTPs increases the urgency of applying this update set.

Exploitation Status: Two zero-days actively exploited pre-patch.
Affected Products: Microsoft Windows, Microsoft Office, Adobe products (specific CVE identifiers pending official Microsoft Security Update Guide confirmation).
Remediation: Apply March 2026 cumulative updates immediately. Prioritize systems running the products associated with the two confirmed zero-days.
Sources: SCC-STY-2026-0001 through SCC-STY-2026-0007; Microsoft Security Update Guide; Cisco Talos (March 11-12, 2026).

3. EchoLeak: Zero-Click Microsoft Excel + Copilot Information Disclosure

A vulnerability designated EchoLeak (CVSS 8.6) enables zero-click information disclosure by chaining Microsoft Excel with Microsoft Copilot. An attacker can craft a malicious Excel document that, when processed by Copilot, exfiltrates data without requiring any user interaction beyond opening the file. The zero-click characteristic makes this particularly dangerous in environments where Copilot is broadly deployed and users regularly open externally sourced spreadsheets.

This vulnerability is notable because it targets the AI assistant layer rather than the underlying application directly, a pattern that will likely increase as AI assistants become more deeply integrated into productivity software. The attack surface for AI-augmented applications is broader than the underlying application alone, and traditional application security models do not fully account for AI co-processing behavior. Organizations should verify that the March 2026 Patch Tuesday update addresses EchoLeak and confirm Copilot-enabled endpoints receive the patch.

CVSS: 8.6 (High).
Exploitation Status: Not confirmed exploited in the wild at time of reporting; zero-click attack vector elevates risk significantly.
Affected Products: Microsoft Excel with Copilot integration.
Remediation: Apply March 2026 Patch Tuesday updates. Review Copilot access policies for external document processing.
Source: SCC-CVE-2026-0007 (TechJacks SCC Pipeline, March 12, 2026).

4. APT28 Deploys Customized Covenant C2 Framework for Long-Term Espionage

Russian state-sponsored threat group APT28 (Fancy Bear, GRU Unit 26165) is actively deploying a customized variant of the open-source Covenant post-exploitation framework. The customization suggests APT28 has invested in adapting the tool to evade signatures written for the stock Covenant implementation. This technique, taking known open-source tools and modifying them sufficiently to defeat existing detection rules, is a well-documented APT tradecraft pattern and indicates ongoing operational investment.

Concurrently, Dutch government authorities issued a warning linking Russian state-sponsored actors to an ongoing campaign hijacking Signal and WhatsApp accounts targeting government officials, military personnel, and journalists. These two activities, combined with the Iranian multi-actor campaign documented separately, reflect a high-tempo period of state-sponsored cyber operations. Organizations in government, defense, media, and critical infrastructure sectors should treat this period as an elevated threat environment and increase monitoring on communication platform activity and endpoint telemetry.

Attribution: APT28 / GRU Unit 26165 (Russia).
Targeted Sectors: Government, defense, media, critical infrastructure.
TTPs: Custom Covenant C2 variant; Signal/WhatsApp account hijacking via phishing.
Source: BleepingComputer (March 10, 2026); Dutch Government advisory (March 9, 2026).

5. Iranian Multi-Actor Campaign Escalates Following Military Operations

Iranian threat actors operating across multiple groups have launched or intensified cyber operations in apparent coordination with or response to recent regional military events. This multi-actor campaign (SCC-CAM-2026-0003, priority score 0.88) represents a higher-risk period for organizations with exposure to Middle Eastern geopolitical dynamics, including energy, defense contracting, government, and financial sectors. The use of multiple Iranian threat actors operating simultaneously suggests organized coordination rather than independent opportunistic activity.

Historical patterns from Iranian cyber campaigns following military events include destructive wiper deployment, data theft and leak operations, and DDoS attacks against public-facing infrastructure. Organizations should review their threat models for Iranian TTPs, validate that detection rules cover known Iranian malware families and tooling (including custom implants and commodity RATs used by groups such as APT33, APT34, and Charming Kitten), and ensure incident response plans account for destructive attack scenarios. Geopolitically motivated campaigns can escalate quickly and without additional warning.

Attribution: Multiple Iranian threat actor groups.
Targeted Sectors: Energy, defense, government, financial services.
Campaign Severity: High (SCC qualitative rating).
Source: SCC-CAM-2026-0003 (TechJacks SCC Pipeline, March 5, 2026).

CISA KEV & Critical CVE Table

CVE	Product	CVSS	CISA KEV Status	KEV Deadline	Description
CVE-2026-22719	VMware Aria Operations	8.1	KEV, Added March 3, 2026	March 24, 2026	Unauthenticated RCE via command injection. Active exploitation confirmed.
CVE-2017-7921	Hikvision IP Cameras	9.8	KEV, Added March 5, 2026	March 26, 2026	Authentication bypass allowing unauthorized access to device stream and configuration.
CVE-2021-22681	Rockwell Automation Logix Controllers (OT/ICS)	9.8	KEV, Added March 5, 2026	March 26, 2026	Authentication bypass in Logix controllers enabling unauthorized command execution in OT environments.
CVE-2026-20079	Cisco Secure Firewall Management Center	10.0	Not yet KEV, Patch-Critical, no workaround	N/A (immediate patching required)	Critical unauthenticated RCE with full confidentiality, integrity, availability impact. No workaround available.
CVE-2026-20131	Cisco Secure Firewall Management Center	10.0	Not yet KEV, Patch-Critical, no workaround	N/A (immediate patching required)	Second critical unauthenticated RCE in same advisory bundle. Paired exploitation possible.
CVE-2026-20122	Cisco Catalyst SD-WAN Manager	7.1	Not KEV, Active exploitation confirmed, campaign expanding	N/A	Part of expanding SD-WAN Manager exploitation campaign. Apply March 5, 2026 Cisco PSIRT advisory patch.
CVE-2026-20128	Cisco Catalyst SD-WAN Manager	7.1	Not KEV, Active exploitation confirmed, campaign expanding	N/A	Second CVE in SD-WAN Manager campaign. Both CVEs exploited in same threat actor operation.
CVE-2026-0006	Android (March 2026 Patch Rollup)	9.8	Not KEV, Actively exploited zero-day	N/A (apply immediately)	Remote code execution zero-day actively exploited in the wild. Included in Android March 2026 security bulletin.
CVE-2026-21385	Qualcomm Android Kernel	7.8	Not KEV, High severity, local privilege escalation	N/A	Local privilege escalation in Qualcomm Android kernel. Addressed in March 2026 Android patch rollup.
CVE-2021-22054	VMware Workspace ONE	7.5	KEV, Added March 10, 2026	Per CISA directive (verify current catalog)	Server-side request forgery vulnerability in Workspace ONE. CISA confirmed active exploitation.
(Ivanti EPM CVE, identifier pending official confirmation)	Ivanti Endpoint Manager (EPM)	High (exact score pending)	KEV, Added March 10, 2026	~March 31, 2026 (verify in KEV catalog)	High-severity EPM vulnerability actively exploited. CISA ordered federal agencies to patch within three weeks of March 10, 2026.
(SolarWinds CVE, identifier pending official confirmation)	SolarWinds (product line pending)	Pending	KEV, Added March 10, 2026	Per CISA directive (verify current catalog)	CISA flagged SolarWinds vulnerability as actively exploited alongside Ivanti and Workspace ONE advisories.
CVE-2026-XXXX (MS Zero-Day 1, identifier pending)	Microsoft Windows / Office (March 2026 Patch Tuesday)	Pending	Actively exploited pre-patch	N/A (apply March 2026 CU)	First of two Microsoft zero-days patched in March 2026 Patch Tuesday, confirmed exploited in the wild.
CVE-2026-XXXX (MS Zero-Day 2, identifier pending)	Microsoft Windows / Office (March 2026 Patch Tuesday)	Pending	Actively exploited pre-patch	N/A (apply March 2026 CU)	Second Microsoft zero-day addressed in March 2026 Patch Tuesday cycle, confirmed exploited pre-release.

Note: CVE identifiers marked “pending” could not be confirmed from the intelligence items provided. Verify against the official Microsoft Security Update Guide, CISA KEV Catalog (cisa.gov/known-exploited-vulnerabilities-catalog), and Ivanti/SolarWinds advisories before populating detection rules or ticketing systems.

Supply Chain & Developer Tool Threats

Malicious npm Package: @openclaw-ai/openclawai Deploys RAT on macOS

Researchers discovered a malicious npm package named @openclaw-ai/openclawai masquerading as an OpenClaw AI installer. The package deploys a remote access trojan (RAT) and steals macOS credentials from compromised developer machines. This is a classic typosquatting and brand-impersonation attack targeting the growing ecosystem of AI developer tooling, a category where developers are actively searching for and experimenting with new packages, lowering their guard compared to established library names.

The threat was amplified by a separate but related campaign in which Microsoft Bing’s AI-enhanced search feature promoted fake OpenClaw GitHub repositories hosting information stealers and proxy malware. The combination of a poisoned package registry entry and AI-assisted search promotion of malicious repositories represents a meaningful escalation in the supply chain attack surface. Developers searching for AI coding tools via Bing may have been served malicious results before finding legitimate sources.

Affected Platform: npm registry; macOS developer environments.
Malware Delivered: RAT, credential stealer, proxy malware.
Recommended Actions:

• Audit npm package installs across developer environments for @openclaw-ai/openclawai and any similar variations.
• Scan macOS developer workstations for RAT indicators of compromise.
• Enforce package allow-listing or software composition analysis (SCA) tooling in CI/CD pipelines.
• Alert developers not to install packages surfaced through AI-enhanced search results without independent verification against the official project’s canonical source.
• Review any credentials stored on potentially affected macOS developer machines for rotation.

Source: The Hacker News (March 9, 2026); BleepingComputer (March 5, 2026).

‘InstallFix’ Campaign: Malvertising Meets ClickFix Targeting AI Coding Tool Users

A campaign designated “InstallFix” combines malvertising with a ClickFix-style social engineering technique targeting developers using AI coding assistants and command-line interfaces. The attack presents users with a fake error or setup screen prompting them to run a command in their terminal, a technique that bypasses traditional executable-download-and-run defenses because the user is executing the payload themselves via copy-paste.

This campaign is specifically calibrated to exploit the behavior patterns of developers working with AI coding tools, who are conditioned to follow installation instructions from unfamiliar sources. Security awareness training for technical staff should explicitly address ClickFix-style attacks and the risk of running terminal commands sourced from web pages, even when those pages appear to be legitimate tool documentation.

Affected Targets: Developers using AI coding assistants, CLI-heavy workflows.
Recommended Actions:

• Train developers on ClickFix attack patterns, specifically, the risk of copy-pasting terminal commands from any web source.
• Monitor endpoint telemetry for unusual shell executions originating from browser processes.
• Consider restricting clipboard-to-terminal paste in high-sensitivity developer environments.

Source: Dark Reading (March 9, 2026).

Chrome Extensions Turn Malicious After Ownership Transfer

Two Google Chrome extensions turned malicious following what appears to be an ownership transfer to a new developer account. After the transfer, the new owner pushed malicious updates enabling code injection into web pages visited by users and active harvesting of sensitive data. Both extensions were originally associated with a legitimate developer, giving them an established user base and review history that reduced user suspicion.

This attack vector, acquiring or compromising an extension with an existing install base and then pushing a malicious update, is particularly difficult to detect because the extension maintains its legitimate-looking metadata and review history. Users who granted the extension permissions months or years ago will not typically re-review those permissions when an update is pushed.

Recommended Actions:

• Audit Chrome extensions deployed across managed endpoints. Remove any extensions with recent ownership transfers or unexpected permission expansions.
• Use enterprise browser management to enforce an approved extension allowlist.
• Enable Chrome’s Enhanced Safe Browsing or equivalent enterprise policy to flag potentially unsafe extensions.
• Specifically check for the two affected extensions referenced in The Hacker News coverage (March 9, 2026), confirm extension names against your browser management console.

Source: The Hacker News (March 9, 2026).

WordPress User Registration & Membership Plugin Actively Exploited (60,000+ Sites)

Attackers are actively exploiting a critical vulnerability in the WordPress User Registration & Membership plugin, installed on more than 60,000 WordPress sites. The vulnerability allows creation of unauthorized administrative accounts, giving attackers full control of affected WordPress installations. Organizations running this plugin should treat any unpatched instance as potentially already compromised and conduct a user account audit in addition to applying the patch.

Recommended Actions:

• Apply the patched version of the User Registration & Membership plugin immediately.
• Audit WordPress admin user accounts for any accounts created after the plugin’s compromise window.
• Review web server logs for indicators of unauthorized admin account creation or privilege escalation.
• If compromise is suspected, treat the WordPress installation as fully compromised and follow incident response procedures for web application compromise.

Source: BleepingComputer (March 5, 2026).

Nation-State & APT Activity Summary

Russia, APT28: Custom Covenant C2 and Messaging Platform Hijacking

Attribution: APT28 / Fancy Bear (GRU Unit 26165), Russia.
Targeted Sectors: Government, military, media, critical infrastructure.
TTPs:

• Deployed a customized variant of the open-source Covenant post-exploitation C2 framework, modified to evade standard detection signatures for the unmodified tool (MITRE ATT&CK: T1583.001, Acquire Infrastructure: Domains; T1059, Command and Scripting Interpreter; T1071, Application Layer Protocol).
• Conducting Signal and WhatsApp account hijacking against government officials, military personnel, and journalists via phishing (MITRE ATT&CK: T1566, Phishing; T1550, Use Alternate Authentication Material).
• Dutch government advisory confirmed Russian state actor attribution for the messaging app campaign.

Detection Guidance: Update Covenant C2 detection rules to account for behavioral rather than signature-based indicators (beaconing cadence, encrypted channel patterns, unusual process spawning). Brief staff with government or media exposure on the Signal/WhatsApp hijacking campaign and require verification of linked-device sessions.

Iran, Multi-Actor Campaign Following Military Operations

Attribution: Multiple Iranian threat groups (specific group attribution pending further analysis).
Targeted Sectors: Energy, defense, government, financial services, telecommunications.
TTPs: Historical Iranian campaign patterns include destructive wiper deployment, data theft and public leak operations, and DDoS against public infrastructure. Current campaign elevated to HIGH priority by SCC pipeline (priority score 0.88).

Detection Guidance: Validate detection coverage for Iranian malware families including SHAMOON/DistTrack wiper, DUSTMAN, known RAT families associated with APT33/APT34/Charming Kitten. Ensure backup integrity for critical systems. Monitor for bulk data access patterns preceding potential exfiltration and leak operations.

North Korea, UNC4899: AirDrop Social Engineering Targets Crypto Developer

Attribution: UNC4899, moderate confidence (North Korea-nexus, aligned with DPRK cryptocurrency theft operations).
Targeted Sectors: Cryptocurrency, Web3, financial technology.
TTPs: UNC4899 compromised a cryptocurrency organization after a developer AirDropped a trojanized file from a personal device to their work device. The trojanized file provided initial access, which was then used for cloud environment compromise leading to cryptocurrency theft.

This operation demonstrates how personal-device-to-work-device file transfer mechanisms (AirDrop, USB, personal cloud sync) create an attack surface that bypasses traditional perimeter controls. The developer’s work device received a malicious file from a compromised personal device, circumventing email and web content filtering. This technique is consistent with DPRK’s documented focus on cryptocurrency theft to fund state programs.

Detection Guidance: Review MDM policies for personal-to-corporate device file transfer restrictions. Brief developers in cryptocurrency and fintech organizations on the UNC4899 social engineering pattern. Monitor for anomalous cloud API activity following any reported unusual file receipt on developer endpoints.

China-Nexus, Critical Infrastructure Campaign Across Asia

Attribution: Chinese threat actor (specific group attribution pending; described as a years-long campaign).
Targeted Sectors: Aviation, energy, government, law enforcement, pharmaceutical, technology, telecommunications across South, Southeast, and East Asia.
TTPs: Web server exploitation for initial access; Mimikatz for credential harvesting and lateral movement (MITRE ATT&CK: T1190, Exploit Public-Facing Application; T1003, OS Credential Dumping).

The breadth of targeted sectors and use of Mimikatz for credential harvesting indicates a long-running intelligence collection operation. Organizations in the named sectors with operations or partnerships in Asia should review web server patch status and look for historical Mimikatz execution artifacts in EDR telemetry. The multi-year campaign duration suggests the actor may have persistent footholds in some targets.

Source: The H